PT-2026-96117

Name of the Vulnerable Software and Affected Versions GoCD versions prior to 26.1.0 Description The internal GoCD UI '/jobStatus.json' API fails to validate if a requested server-assigned job ID belongs to the specified pipeline and stage. This allows an authenticated user to guess job IDs and...

CVE-2026-92430 Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX Webhook

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying...

WordPress Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit plugin 3.6.1-5.4.6 - Unauthenticated Order Status Manipulation vulnerability

Unauthenticated Order Status Manipulation vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Rede Itaú for WooCommerce versions 3.6.1-5.4.6...

EUVD-2026-83516

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying...

CVE-2026-92430 Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX Webhook

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying...

CVE-2026-92430

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin, affecting versions 3.6.1-5.4.6 , contains an unauthenticated order status manipulation vulnerability. The root cause is the failure to verify the authenticity of its PIX payment webhook before updating an order's...

PT-2026-95769

Name of the Vulnerable Software and Affected Versions Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin versions prior to 5.4.7 Description The plugin fails to verify the authenticity of its PIX payment webhook before updating the status of an order. This allows...

CVE-2026-92430: Missing Authorization

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying...

CVE-2026-11549

creationtimestamp| type| source ---|---|--- 2026-09-18 21:44:33+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117294227363772465...

CVE-2026-12739

The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

EUVD-2026-82662

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.50 - Instructor+ Order Status Manipulation vulnerability

Instructor+ Order Status Manipulation vulnerability discovered by Shivamani Vastrala in WordPress Plugin MasterStudy LMS versions 3.7.50...

SUSE CVE-2026-90124

In the Linux kernel, the following vulnerability has been resolved: irqchip/renesas-rzg2l: Fix loss of interrupt rzg2lclearirqint and rzg2lcleartintint perform a read-modify-write on the ISCR/TSCR status registers to clear the bit for the interrupt just handled. Since these registers are...

Linux Distros Unpatched Vulnerability : CVE-2026-90412

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvmet: fix return status of RMI log page on allocation failure nvmetexecutegetlogpagermi leaves 'status' holding NVMESCSUCCESS set by the successful...

Linux Distros Unpatched Vulnerability : CVE-2026-90070

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tpm: st33zp24: Return zero on status read failure st33zp24status ignores the result of the transport read and returns data even when no byte was received. The I...

PT-2026-95281

Name of the Vulnerable Software and Affected Versions WP Easy Pay – Payment and Donation form Builder for Square versions prior to 4.5.1 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated...

CVE-2026-93374

creationtimestamp| type| source ---|---|--- 2026-09-17 21:29:11+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117288504463693335 2026-09-18 04:45:05+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260918 2026-09-18 14:50:05+00:00| seen|...

DEBIAN-CVE-2026-92483

In the Linux kernel, the following vulnerability has been resolved: liveupdate: Remember FLB retrieve status LUO keeps track of successful retrieve attempts on an FLB. It does so to avoid multiple retrievals of the same FLB. Multiple retrievals cause problems because once the FLB is retrieved, th...

DEBIAN-CVE-2026-90412

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix return status of RMI log page on allocation failure nvmetexecutegetlogpagermi leaves 'status' holding NVMESCSUCCESS set by the successful nvmetreqfindns call when the kzalloc for the log buffer fails. It then jumps to...

CVE-2026-90412

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix return status of RMI log page on allocation failure nvmetexecutegetlogpagermi leaves 'status' holding NVMESCSUCCESS set by the successful nvmetreqfindns call when the kzalloc for the log buffer fails. It then jumps to...